Secure authentication and transaction system and method

Abstract

A secure user authentication system, operable over a client-server communications network to authenticate a system user. The system includes an application server which includes a site which is able to be enabled, and an authentication server, which is able to enable the application server site. The authentication server includes a core database, and receives and stores user authentication-enabling data in the core database. The system further includes a client, and a client program which is able to be actuated in the client. The client program includes the user authentication-enabling data. Upon actuation, the client program automatically directly connects to the authentication server, and sends the client authentication-enabling data to the authentication server, for secure user authentication by the authentication server.

What is claimed is: 
     
       1. An authentication server comprising a non-transitory memory for storing machine instructions that are to be executed by a processor, the machine instructions when executed implement the following instructions:
 registering a web-based application server for secure transacting using a merchant ID; 
 receiving a client account identifier from an issuing bank; 
 providing a token software for download by a client device from an implementer of the authentication server, the token software operating from a secure element on the client device wherein the client account identifier is stored for the token software 
 connecting with the client device through a secure connection between the client device and the authentication server to authenticate the client device over the secure connection such that the web-based application server is not an intermediary between the client device and the authentication server, and the secure connection is formed with the client device upon the token software on the client device automatically initiating the secure connection, upon actuation of the token software by a user for a payment transaction, with unique connection information for the authentication server included in the token software; 
 receiving a token output representative of the client account identifier and authentication-enabling data from the token software on the client device over the secure connection; 
 authenticating the client device by comparing the token output representative of the client account identifier and authentication-enabling data received from the token software on the client device with information and authentication-enabling data stored in the authentication server; 
 authenticating the web-based application server with the merchant ID and merchant information stored by the authentication server during registration; and 
 executing a secure transaction between the client device and the web-based application server responsive to authentication of the client device and the web-based application server. 
 
     
     
       2. The authentication server of  claim 1 , wherein the secure connection is formed using an IP address for the authentication server that is hardcoded in the token software. 
     
     
       3. The authentication server of  claim 1 , wherein the secure connection includes a VPN. 
     
     
       4. The authentication server of  claim 1 , wherein the merchant ID is a website signature. 
     
     
       5. The authentication server of  claim 1 , wherein the secure connection is a direct connection between the token software of the client device and the authentication server. 
     
     
       6. The authentication server of  claim 1 , wherein the unique connection information includes an embedded IP address for connection to the authentication server. 
     
     
       7. The authentication server of  claim 1 , wherein the authentication server does not send the authentication-enabling data to the web-based application server. 
     
     
       8. A method of authenticating a client device and a merchant server for a payment transaction comprising:
 registering the merchant server and responsive to registration assigning merchant identifying information associated with the merchant server; 
 providing a token software for download by the client device; 
 sending, over a client-server network, a client account number to the token software operating on the client device for storage in a secure element of the client device; 
 directing the client device from the merchant server to an authentication server for authentication of the client device through a secure connection between the client device and authentication server over the client-server network, the secure connection being between the client device and authentication server without the merchant server; 
 establishing the secure connection between the client device and the authentication server responsive to the client device requesting the secure connection upon actuation of the token software on the client device by a user desiring to transact, the token software initiating the secure connection using connection information stored in the secure element and accessible to the token software, the connection information being uniquely representative of the authentication server; 
 generating a token output with the token software, the token output being associated with authentication-enabling data and the client account number stored in the secure element; 
 sending the token output from the client device to the authentication server through the secure connection to authenticate the client device; 
 comparing information derived from the token output received from the client device with information stored in the authentication server to verify the client device is authentic; and 
 authorizing the payment transaction, responsive to verifying the client device is authentic, by sending encrypted information representative of the client account number and payment information including the merchant identifying information to merchant server for payment processing. 
 
     
     
       9. The method of  claim 8 , further comprising connecting the secure element of the client device to the authentication server via an embedded IP address. 
     
     
       10. The method of  claim 8 , wherein the merchant identifying information includes merchant banking information. 
     
     
       11. The method  claim 8 , wherein the merchant identifying information includes a merchant ID, and the token software is downloadable. 
     
     
       12. The method of  claim 8 , wherein encryption includes key based encryption. 
     
     
       13. The method of  claim 8 , wherein the client device connects to the merchant server via a web browser. 
     
     
       14. The method of  claim 8 , wherein the connection information is uniquely representative of the authentication server's network address. 
     
     
       15. A system to authenticate a client device and a merchant application server for a payment transaction comprising:
 a client device with a secure element and capable of operating a token software cooperating with a secure element; 
 an authentication server programmed to:
 send a unique client account identifier and authentication-enabling data for storage in the secure element of the client device by the token software; 
 register a merchant application server such that the authentication server has unique information associated with a merchant and the merchant application server that communicates to authenticate the merchant application server; 
 
 connect with the client device to form a secure connection upon initiation by the token software on the client device using unique connection information hardcoded in the token software or secure element of the client device, the secure connection configured such that information communicated does not pass through the merchant application server; 
 receive, from the client device over the secure connection between the client device and the authentication server an encrypted output generated by the token software and derived from the unique client account identifier and the authentication-enabling data stored in the secure element of the client device; 
 compare authenticating information from the encrypted output and representative of the unique client account identifier and the authentication-enabling data with information stored by the authenticating server to authenticate the client device; and 
 generate and send encrypted payment information including the unique information associated with the merchant responsive to authenticating the client to authorize payment to the merchant without providing the merchant a credit, debit, or bank account number. 
 
     
     
       16. The system of  claim 15 , wherein the secure element is hard coded to automatically and directly connect with the authentication server upon actuation for a payment transaction. 
     
     
       17. The system of  claim 15 , wherein the secure element is programmed to generate and send the encrypted output associated with the unique client account identifier and the authentication-enabling data to the authentication server. 
     
     
       18. The system of  claim 15 , wherein the token software is downloadable.